CVE-2024-24495

CVE-2024-24495 is a SQL injection vulnerability affecting Daily Habit Tracker version 1.0, arising from the delete-tracker.php endpoint. Remote attackers can craft a GET request to trigger arbitrary code execution due to insecure handling of input in the targeted PHP file. The Red Hat advisory co...

Plone Security Vulnerability

Plone is an open source content management system CMS built on the Zope application server. A security vulnerability exists in Plone official Docker version 5.2.13 5221, which stems from a vulnerability that allows an unauthenticated attacker to upload files to the server or delete files...

PT-2024-20421 · Unknown · Daily Habit Tracker

Name of the Vulnerable Software and Affected Versions: Daily Habit Tracker version 1.0 Description: An issue in the software allows a remote attacker to manipulate trackers via the "home.php", "add-tracker.php", "delete-tracker.php", "update-tracker.php" components. Recommendations: For Daily Hab...

CVE-2024-23756

The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 5221, allowing unauthenticated attackers to execute dangerous actions such as uploading files to the server or deleting them...

CVE-2024-1252

A vulnerability classified as critical was found in Tongda OA 2017 up to 11.9. Affected by this vulnerability is an unknown functionality of the file /general/attendance/manage/askduty/delete.php. The manipulation of the argument ASKDUTYID leads to sql injection. The exploit has been disclosed to...

CVE-2024-1251

A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.10. Affected is an unknown function of the file /general/email/outbox/delete.php. The manipulation of the argument DELETESTR leads to sql injection. The exploit has been disclosed to the public and may be used...

CVE-2024-24592

Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, modify and delete files...

CVE-2024-24592

Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily access, create, modify and delete files...

CVE-2023-28049

Dell Command | Monitor, versions prior to 10.9, contain an arbitrary folder deletion vulnerability. A locally authenticated malicious user may exploit this vulnerability in order to perform a privileged arbitrary file delete...

CVE-2023-28049

Dell Command | Monitor, versions prior to 10.9, contain an arbitrary folder deletion vulnerability. A locally authenticated malicious user may exploit this vulnerability in order to perform a privileged arbitrary file delete...

TONGDA Office Anywhere SQL Injection Vulnerability

TONGDA Office Anywhere is a collaborative office OA system. A SQL injection vulnerability exists in TONGDA Office Anywhere 2017 version 11.10 and earlier versions, which stems from an incorrect operation of the parameter DELETESTR that can lead to sql injection...

PT-2024-17638 · Unknown · Tongda Oa 2017

Name of the Vulnerable Software and Affected Versions: Tongda OA 2017 versions up to 11.9 Description: A critical vulnerability was found in Tongda OA 2017. The issue affects an unknown functionality of the file /general/attendance/manage/ask duty/delete.php. The manipulation of the ASK DUTY ID...

PT-2024-17634 · Tongda Oa · Tongda Oa

Name of the Vulnerable Software and Affected Versions: Tongda OA 2017 versions up to 11.10 Description: A critical vulnerability has been found in Tongda OA. The issue affects an unknown function of the file /general/email/outbox/delete.php. The manipulation of the DELETE STR argument leads to SQ...

CVE-2024-0859 Affiliates Manager <= 2.9.34 - Cross-Site Request Forgery

The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.34. This is due to missing or incorrect nonce validation on the processbulkaction function in ListAffiliatesTable.php. This makes it possible for unauthenticated...

PT-2024-20410 · Unknown · Flusity-Cms

Name of the Vulnerable Software and Affected Versions: flusity-CMS version 2.33 Description: A Cross Site Request Forgery issue allows a remote attacker to execute arbitrary code via the delete post.php endpoint. Recommendations: For flusity-CMS version 2.33, consider disabling access to the dele...

phpMyFAQ Access Control Error Vulnerability

phpMyFAQ is a multilingual, fully database-driven FAQ system by the individual developer Thorsten Rinne. An Access Control Error vulnerability exists in versions prior to phpMyFAQ 3.2.5, which stems from a user deletion page that allows an attacker to spoof another user's details to create a...

CVE-2021-46902

An issue was discovered in LTOS-Web-Interface in Meinberg LANTIME-Firmware before 6.24.029 MBGID-9343 and 7 before 7.04.008 MBGID-6303. Path validation is mishandled, and thus an admin can read or delete files in violation of expected access controls...

CVE-2024-1197

A vulnerability, which was classified as critical, has been found in SourceCodester Testimonial Page Manager 1.0. This issue affects some unknown processing of the file delete-testimonial.php of the component HTTP GET Request Handler. The manipulation of the argument testimony leads to sql...

Testimonial Page Manager Security Vulnerability

Testimonial Page Manager is a versatile web application for rems individual developers designed to simplify the process of presenting customer feedback and testimonials. A security vulnerability exists in SourceCodester Testimonial Page Manager version 1.0, which stems from the parameter testimon...

PT-2024-17373 · Unknown · Sourcecodester Testimonial Page Manager

Name of the Vulnerable Software and Affected Versions: SourceCodester Testimonial Page Manager version 1.0 Description: A critical issue has been found in the processing of the file delete-testimonial.php of the component HTTP GET Request Handler. The manipulation of the testimony argument leads ...